Extracted

• • Target
    ab95748b89f331c5448730be059f73dc13e00a5fdf633c4f19f40a347bae8afa
  • Size 45KB
  • SHA256 ab95748b89f331c5448730be059f73dc13e00a5fdf633c4f19f40a347bae8afa
  • MD5 49331cab2c2abc0784e93d0873949d12
  • SHA1 62477e4c17f9c05b74871abe07f2c127bf545089
  • SHA512 b951fdc9908e95bc10406797c0cf5bcee894044083a156e3ec1284bffc88fe2e1c24d64fcfb1e3f79bb847a60c8c98c5a659737c6a1c7addcee27d2d2f012cc9
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVD0ewUkA1MiZPI7zjbLgy3i+T9/qPctPspLqBDZEx:MuBGJTPho2iwvDiW73b0ySYkctEpgdEx
  • TLSH
    T133232A0037E9812BF2BE4B7899F26245867AF6633603D5891CC451DB5613FC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2